diff --git a/dev/api-gateway/bootstrap-kustomization.yaml b/dev/api-gateway/bootstrap-kustomization.yaml
new file mode 100644
index 0000000..328024b
--- /dev/null
+++ b/dev/api-gateway/bootstrap-kustomization.yaml
@@ -0,0 +1,24 @@
+# Watches ./dev/api-gateway so the entrypoints in it — the GitRepository above,
+# the gateway and policies Kustomizations, the ExternalSecrets — reconcile from
+# git instead of waiting on a kubectl apply. Lives in that directory, so it
+# manages itself.
+#
+# In the payments namespace, not flux-system. The gateway Kustomizations sat in
+# flux-system only because postBuild.substituteFrom reads a ConfigMap from its
+# own namespace and dataplane-template-defaults existed nowhere else. That
+# ConfigMap is now in every domain namespace, so the constraint is gone and the
+# team can own its own gateway.
+#
+# Apply once with kubectl. That is the last manual apply this repo needs.
+apiVersion: kustomize.toolkit.fluxcd.io/v1
+kind: Kustomization
+metadata:
+  name: dataplane-payments-dev-bootstrap
+  namespace: payments
+spec:
+  interval: 10m
+  sourceRef:
+    kind: GitRepository
+    name: dataplane-payments-dev
+  path: ./dev/api-gateway
+  prune: true
diff --git a/dev/api-gateway/externalsecret-control-plane.yaml b/dev/api-gateway/externalsecret-control-plane.yaml
index 2f75c27..03ddd4b 100644
--- a/dev/api-gateway/externalsecret-control-plane.yaml
+++ b/dev/api-gateway/externalsecret-control-plane.yaml
@@ -1,3 +1,8 @@
+# Moved out of flux-system with the Kustomization that reads it. It only ever
+# lived there because postBuild.substituteFrom resolves in the Kustomization's
+# own namespace, and that Kustomization had to be in flux-system to reach
+# dataplane-template-defaults. Both now sit in the domain namespace, so the
+# control-plane id no longer transits a shared namespace at all.
 # The Control Plane id, delivered to flux-system so gateway-kustomization.yaml
 # can substitute it instead of carrying a hardcoded UUID.
 #
@@ -13,7 +18,7 @@ apiVersion: external-secrets.io/v1
 kind: ExternalSecret
 metadata:
   name: payments-dev-control-plane
-  namespace: flux-system
+  namespace: payments
 spec:
   refreshInterval: 1h
   secretStoreRef:
diff --git a/dev/api-gateway/gateway-kustomization.yaml b/dev/api-gateway/gateway-kustomization.yaml
index c51768a..d52fd49 100644
--- a/dev/api-gateway/gateway-kustomization.yaml
+++ b/dev/api-gateway/gateway-kustomization.yaml
@@ -7,12 +7,17 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: payments-dev-api-gateway
-  namespace: flux-system
+  namespace: payments
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: k8s-platform
+    # k8s-platform lives in flux-system: the templates are the platform's,
+    # this Kustomization is the team's. sourceRef resolves in the
+    # Kustomization's own namespace unless told otherwise, hence the
+    # explicit namespace rather than a copy of the source per domain.
+    namespace: flux-system
   path: ./dataplane-template
   prune: true
   postBuild:
diff --git a/dev/api-gateway/gitrepository.yaml b/dev/api-gateway/gitrepository.yaml
new file mode 100644
index 0000000..89add97
--- /dev/null
+++ b/dev/api-gateway/gitrepository.yaml
@@ -0,0 +1,20 @@
+# This repo, as a source Flux can read. It had none: its Kustomizations point at
+# k8s-platform for the templates, and nothing ever needed to read the repo that
+# declares them — because those declarations were applied by hand.
+#
+# Reuses the domain's existing deploy key rather than minting a new one, having
+# verified that key reads the dataplane repositories. Worth knowing what that
+# implies: the key is not scoped to a single repository, so the isolation its
+# per-repo name suggests does not exist.
+apiVersion: source.toolkit.fluxcd.io/v1
+kind: GitRepository
+metadata:
+  name: dataplane-payments-dev
+  namespace: payments
+spec:
+  interval: 5m
+  url: ssh://git@gitea.sttlab.eu:2222/stt/kong-dataplane-payments.git
+  secretRef:
+    name: payments-api-git-auth
+  ref:
+    branch: main
diff --git a/dev/api-gateway/policies-kustomization.yaml b/dev/api-gateway/policies-kustomization.yaml
index bce8503..9baca05 100644
--- a/dev/api-gateway/policies-kustomization.yaml
+++ b/dev/api-gateway/policies-kustomization.yaml
@@ -7,12 +7,17 @@ apiVersion: kustomize.toolkit.fluxcd.io/v1
 kind: Kustomization
 metadata:
   name: payments-dev-api-gateway-policies
-  namespace: flux-system
+  namespace: payments
 spec:
   interval: 10m
   sourceRef:
     kind: GitRepository
     name: k8s-platform
+    # k8s-platform lives in flux-system: the templates are the platform's,
+    # this Kustomization is the team's. sourceRef resolves in the
+    # Kustomization's own namespace unless told otherwise, hence the
+    # explicit namespace rather than a copy of the source per domain.
+    namespace: flux-system
   path: ./dataplane-globalpolicy-template
   prune: true
   postBuild: